Initial public ModelForge release

2026-09-01 21:30:16 +02:00
commit 7082ab955a
490 changed files with 104252 additions and 0 deletions
@@ -0,0 +1,36 @@
+# Isolated public-candidate acceptance
+
+The Gitea workflow `.gitea/workflows/public-candidate-acceptance.yml` moves the expensive release
+proof off a developer workstation and onto a Docker-capable server runner. It is manual-only and
+accepts an exact canonical commit SHA. It does not invoke `unraid-deploy.yml`, the deploy controller
+or the production Compose project.
+
+The job creates a curated public export, validates its content manifest, scans it with Gitleaks,
+then creates a temporary parentless Git commit so release provenance describes the exact exported
+tree. From that tree it:
+
+1. builds API, Console, Node Agent and Runtime Worker images with OCI identity;
+2. produces the release manifest, checksums, CycloneDX inventory and image provenance;
+3. scans every exact image ID with checksum-pinned Trivy and rejects ambiguous reports or any
+   HIGH/CRITICAL finding;
+4. starts API, Console, PostgreSQL and Redis with the production overlay under a unique
+   `modelforge-rc-*` Compose project;
+5. uses newly generated secrets, loopback-only ephemeral host ports and project-scoped volumes;
+6. proves liveness, readiness, version identity, Console serving and both sides of the operator
+   authentication boundary; and
+7. always removes the temporary containers, networks, volumes and four candidate image tags. An
+   independent `if: always()` workflow cleanup repeats the exact project-label cleanup after a
+   failure, cancellation or timeout; it never runs a host-wide Docker prune.
+
+No Node Agent or Runtime Worker is started by this clean-install gate. Consequently it creates no
+compute identity and cannot interact with the production GPU node. A later GPU qualification must
+enrol a disposable `rc-canary` identity with `production_eligible=false` and retain that separate
+evidence.
+
+After the workflow exists on the default branch, dispatch it directly and enter the exact pushed
+commit. Before merge, dispatch the existing **Managed validation** workflow on the candidate branch
+with profile `build`; that profile calls the same acceptance workflow with `gitea.sha`. Use the
+actual intended Console API origin for a publishable artifact; the managed-branch route uses
+`https://modelforge.example.test` and therefore produces non-publishable infrastructure rehearsal
+artifacts. Evidence is retained for 90 days. A failed scan or install is evidence of a blocker, not
+permission to bypass the gate.